How to limit the daily volume of a specific index?


I have one system which is the indexer, but there are multiple indexes (based upon projects)
Different projects have purchased licenses so I want to limit the indexes to various daily limits.
For example project A has purchased a 5Gig license and project B has purchased a 10Gig license.
I have project A data going to index X and project B data going to index Y.
Since both licenses are put into the auto_generated_pool_enterprise there is 15Gig volume allowed.
I want to limit project A (index X) to 5Gig per day and project B (index Y) to 10Gig per day.

If Project A (index X) gets more than 5Gig in a day, I don't want it to consume the other available license since that project didn't purchase it. I don't want to use a disk limit.

How can I limit the daily volume of a specific index?


Labels (2)


This would be useful to a lot of people I think, ie one app starts indexing abnormal volumes impacting the platform, it would be useful to be able to cap volumes per index to avoid the platform not indexing further data for other apps.

0 Karma


No, you cannot. Same answer given by MarioM

0 Karma

Path Finder

Even i am searching for the exact scenario to restrict the index by volume did some one find a way to do this

0 Karma


you cannot...license and license pooling are per indexer not per indexes.

The only option is to split your project per indexer.

New Member

is this still the case ? I see this response as of Sep 2012 and Iam using 6.1 fo rnow and ready to upgrade to 6.2 and am in the wsame exact scenario the original poster has raised.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...